All vulnerabilities
CVE-2026-93258

Linux: ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0e7459abff46e28e64367057038ef8607e63f599Fixed versionCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0e7459abff46e28e64367057038ef8607e63f599LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()

This reverts commit 58b6fcd2ab34 ("ocfs2: mark inode bad upon validation failure during read").

Since 'make_bad_inode()' resets inode type to S_IFREG, doing this for directory inode during active VFS lookup is likely to confuse the latter, including VFS_BUG_ON_INODE() triggered in this case.

Text from CVE List

Affected versions 6

  • Linuxaffected: 58b6fcd2ab34399258dc509f701d0986a8e0bcaa before 0e7459abff46e28e64367057038ef8607e63f599CVE List
  • Linuxaffected: 58b6fcd2ab34399258dc509f701d0986a8e0bcaa before d48ace65322001b41bb5322442a21425ef4407d4CVE List
  • Linuxaffected: 6.19CVE List
  • Linuxunaffected: all versions before 6.19CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2